Gridinsoft Logo
File Icon

Monotone.exe Malware RedLine Analysis

Updated 1 year ago
Checked by Malware Check
Monotone.exe

Technical Analysis

File Name Monotone.exe
File Type
PE32+ executable (console) x86-64, for MS Windows
Scanner Version 1.0.158.174
Database Version 2024-02-04 05:00:34 UTC
⚠

Malware.Win64.RedLine.bot

Malware family: RedLine

RedLine Stealer is a data exfiltration tool that targets browser data, system information, and installed software credentials. It spreads through email attachments and compromised websites. Beyond data theft, it serves as a delivery mechanism for additional malware payloads, creating multiple attack vectors on infected systems.
N/A
Detection Rate
164,352
File Size (bytes)
2024-02-04
Analysis Date

Scan Another File

File Identification

Hash Type Value Action
MD5
cd6cddac2686df01814705f21e6da343
SHA1
f29ad4efdc160ffba5cb63e01349ec9b84123e30
SHA256
0f7f86530b7fa2e693a2a3a5bf69957e61c2f45d39418d077285a1ea6f4bb992
SHA512
a673d521f316d3e0fa87a99effa33c5dc4fde315e72b7f6cbb828a94ffe8ebeed4bf9ca6fe858b3c69327aa4ce05ae02b37e2a392abb7cc728c4bbe2ab9a6de4
ImpHash
f326f88ca83c9aacaa44acfb8884f1d4

PE Analysis

Basic Information

▼
Icon
Hash: e759b9982cf1c77678a8c81ae8b2f999
Fuzzy: 3b5d3c7d207e37dceeedd301e35e2e58
dHash: 0000000000000000
Image Base 0x140000000
Entry Point 0x140001000
Compilation Time 2018-02-01 19:43:01
Checksum 0x00000000 (Actual: 0x00034430)
OS Version 4.0
PEiD Signatures PE32+ executable (console) x86-64, for MS Windows
Digital Signature The PE file does not contain a certificate table.
Imports 9 libraries
msvcrt, KERNEL32, SHELL32, WINMM, OLE32, SHLWAPI, USER32, GDI32, COMCTL32
Exports 0 functions
Resources 11 Resources
Sections 6 Sections

PE Sections

▼
Name Virtual Address Virtual Size Raw Size Entropy Characteristics MD5
.code 0x00001000 23,417 bytes 23,552 bytes 5.51 (Normal) IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ AA16F98B8FE7F2B775E16D029F583896
.text 0x00007000 68,149 bytes 68,608 bytes 6.33 (Normal) IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ 981BC6E1F1F7AA59AFF461D618525A35
.rdata 0x00018000 19,341 bytes 19,456 bytes 6.68 (Compressed) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 626F5B2F4C9E5C74296566E1AEDB36B8
.pdata 0x0001d000 4,404 bytes 4,608 bytes 4.99 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 160E0BE5CE9D191773103A22E378FE5D
.data 0x0001f000 9,128 bytes 5,632 bytes 4.38 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 21C9A825E380FA805C2EFE06CC5D1ADB
.rsrc 0x00022000 41,088 bytes 41,472 bytes 5.82 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ EDE0B08941D6148BFF99C8C9F8B2736D
Entropy Analysis Alert

1 section(s) with elevated entropy (≥6.5) - possible compression

Resource Analysis

▼
Total Resources: 11 (40,198 bytes)
Resource Type Count Total Size Percentage
RT_ICON 5 21,338 bytes
53.1%
RT_RCDATA 4 18,112 bytes
45.1%
RT_GROUP_ICON 1 76 bytes
0.2%
RT_MANIFEST 1 672 bytes
1.7%

Certificate Chain Analysis

▼
No Digital Signatures

This file is not digitally signed.

Security Implications:
  • Cannot verify the publisher's identity
  • Increased security risk when running this file
  • May trigger security warnings on some systems

⚠ This file either lacks a digital signature or the certificate chain could not be verified
Exercise caution when executing unsigned files from unknown sources

Certificate Verification Status

The PE file does not contain a certificate table.

Recommendation: Verify the file source and ensure it comes from a trusted publisher.

Malware.Win64.RedLine.bot Removal

Gridinsoft has the capability to identify and eliminate Malware.Win64.RedLine.bot without requiring further user intervention.

Download Anti-Malware

Removal Instructions

Follow these steps to completely remove the threat from your system

  1. Start by downloading Gridinsoft Anti-Malware to your computer.
  2. Double-click on the gsam-en-install.exe file and follow the on-screen instructions to install the program.
  3. Once the installation of Gridinsoft Anti-Malware is complete, the program will open on the Scan screen.
  4. Click on the "Standard Scan" button to begin scanning your computer for threats.
  5. After the scanning process is finished, click on "Clean Now" to remove any detected threats.
  6. If prompted, restart your system to complete the removal process and ensure all threats are eliminated.
Important: Before You Start
Disconnect from the internet to prevent the malware from spreading or downloading additional threats. Run the scan in Safe Mode for better detection and removal of persistent threats.

Leave a Comment

Share your thoughts or insights about this file. Do you align with our conclusion?

* Your feedback could influence our rating, and rest assured, your email will remain confidential and will only be used to communicate with you if necessary.
Your Score for

Gridinsoft Anti-Malware

Cure your PC from any kind of malware

GridinSoft Anti-Malware will help you to protect your computer from spyware, trojans, backdoors, rootkits. It cleans your system from annoying advertisement modules and other malicious stuff developed by hackers.

Anti-Malware Download Now
Gridinsoft Anti-Malware